Description

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/artifacts_v4.go parses the value and returns it with the comparison against the requesting task's run ID left commented out. The signed URLs the backend issues are authenticated by an HMAC whose key is hardcoded to the four bytes 0xba 0xdb 0xee 0xf0, identical in every build, computed over a concatenation of endpoint, expiry, artifact name and task ID with no length prefix or delimiter, so signatures are both forgeable and ambiguous between differing artifact name and task ID pairs. The --artifact-server-addr flag defaults to the host's outbound address rather than loopback, leaving the backend reachable from the surrounding network. Any client that can reach it may read, overwrite or delete the artifacts of a concurrently running job with no credentials, exposing build outputs such as secrets and deployment credentials and permitting their replacement before the owning job consumes them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-24T14:17:02.857Z",
  "pubdate": "2026-08-24T14:17:02.857Z",
  "executiveSummary": "The vulnerability resides in the HTTP Artifacts V4 backend initialized by act when workflows utilize actions/upload-artifact@v4 or actions/download-artifact@v4.\nThis security flaw encompasses multiple critical weaknesses including missing authorization checks, predictable and hardcoded HMAC cryptographic signing keys, and insecure network binding defaults.\nUnauthenticated network adversaries or local network entities can exploit these weaknesses to interact directly with control-plane RPCs such as CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact, and DeleteArtifact.\nAn attacker can read, overwrite, or delete arbitrary artifacts of concurrently running jobs without requiring any credentials.\nThis exposes sensitive build outputs, including plaintext secrets and deployment credentials, and allows malicious replacement of artifacts prior to consumption by the legitimate owning job.\nThe risk is significantly amplified because the artifact server binds by default to the host's outbound address rather than the local loopback interface, exposing the service to the broader network.",
  "technicalDetails": "The root cause of the authorization flaw stems from the validateRunIDV4 function located in pkg/artifacts/artifacts_v4.go.\nThe function parses the caller-supplied workflow_run_backend_id parameter from control-plane RPC requests but completely omits validation against the requesting task's actual run ID due to commented-out comparison logic.\nConsequently, the backend accepts arbitrary workflow run identifiers without verifying requester ownership.\nCryptographic integrity is severely compromised by the implementation of signed URLs within the backend.\nSigned URLs are authenticated utilizing an HMAC mechanism where the signing key is hardcoded statically to the four bytes 0xba 0xdb 0xee 0xf0 across all builds.\nFurthermore, the HMAC is computed over a concatenation of the endpoint, expiry, artifact name, and task ID without any length prefixing or delimiters, resulting in signature forgeability and cryptographic ambiguity across differing artifact name and task ID pairs.\nNetwork exposure is elevated because the --artifact-server-addr configuration flag defaults to binding on the host's outbound network interface rather than localhost (127.0.0.1), leaving the server accessible to any adjacent host sharing network routing.\nThe step-by-step attack flow proceeds as follows: an attacker on the local network or adjacent routing scope discovers the exposed HTTP Artifacts V4 backend listening on the host's outbound IP address.\nLeveraging the hardcoded HMAC key (0xba 0xdb 0xee 0xf0), the attacker crafts valid signed URLs or exploits the unvalidated workflow_run_backend_id parameter within control-plane RPCs.\nThe attacker issues RPC commands such as ListArtifacts to discover active job artifacts, GetSignedArtifactURL to target specific files, or DeleteArtifact and CreateArtifact equivalents to overwrite legitimate build outputs with malicious payloads.\nWhen the target workflow subsequently invokes actions/download-artifact@v4, it consumes the attacker-modified artifacts, leading to potential post-exploitation impact such as secret exfiltration, arbitrary code execution via poisoned deployment assets, or pipeline compromise."
}